Key-only SSH with fail2ban and I sleep easy a night.

I would go for refurb, business line SFF machines. Something like ThinkCentre or Optiplex. Specific form factor based on drive needs but the smaller you go the more power efficient. I have one on the bigger side (internal psu) that runs about 12W idle.

Just double check that it can handle hardware transcoding. Should fit right in your budget!